Free Security & Privacy Tools
Check your IP, test for VPN leaks, verify SSL certificates, and inspect DNS, Whois, and password strength - free privacy and security tools.
About Security Tools
See your public address with What Is My IP, confirm your VPN is hiding you with the VPN Leak Test, check a site's certificate with the SSL Checker, and inspect a domain's DNS and Whois records. The Password Strength Checker shows how tough your password really is.
Use these tools only on systems and domains you own or are authorised to test. They help you understand your own security, not a guarantee of it.
Password strength is about guesses, not rules
Strength is measured in bits of entropy — how large a search space an attacker faces. Length beats complexity decisively, because each additional character multiplies the space while an additional character class only widens the base slightly. P@ssw0rd! satisfies almost every corporate complexity policy and appears in every cracking dictionary, since the substitutions it uses are the first transformations any cracking tool applies. This is why NIST guidance has recommended dropping composition rules in favour of length since 2017.
Attackers do not brute-force alphabetically. They try known breached passwords first — billions are publicly available — then dictionary words with common substitutions, then keyboard patterns and dates. Any password that has appeared in a breach has an effective strength of zero however complex it looks.
What actually protects an account
Unique passwords everywhere, held in a password manager, with two-factor authentication on anything important. Reuse is the leading cause of account takeover by a wide margin: one breached site should not endanger any other. Two-factor authentication protects the account even when the password leaks, which is the scenario that actually happens. Your email account deserves the strongest protection you give anything, because it is the reset path for everything else.
Network and certificate checks
A VPN is only working if nothing escapes the tunnel — DNS queries, WebRTC requests and IPv6 traffic all leak by default in common configurations, and the connection looks entirely normal while they do. On certificates, the padlock means the connection is private and the domain matches; it does not mean the site is honest, since phishing sites obtain valid certificates for their own domains routinely.
These tools run in your browser and transmit nothing. Even so, the safer habit is to test a password of similar structure rather than one you actually use.
Frequently Asked Questions
What is a VPN or WebRTC leak?
It is when your real IP address is exposed to websites despite using a VPN. The VPN Leak Test checks for this.
Is it safe to test my password strength here?
The check runs in your browser and is not sent anywhere. As good practice, test similar patterns rather than your real active passwords.
Can I check any website or domain?
You can inspect public information like SSL, DNS, and Whois. Only run security tests on systems you own or are permitted to test.
Is length or complexity more important in a password?
Length, decisively. Each extra character multiplies the search space, while adding a character class only widens the base. A long passphrase beats a short complex string by a wide margin.
What is the single most effective security step?
Enabling two-factor authentication on important accounts. It protects you even if the password is stolen, phished or leaked in a breach — which is the scenario that actually occurs.
Does a VPN make me anonymous?
No. It hides your address from sites and your destinations from your ISP, but the VPN provider then sees both, and logins, cookies and browser fingerprinting still identify you.